CVE-2016-5295

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-11 · updated 2026-06-17
Weakness: CWE-264

Description

This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox < 50.

Affected products

Mozilla Firefox: before 50.0 — fixed in 50.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 50.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/94337
http://www.securitytracker.com/id/1037298
https://bugzilla.mozilla.org/show_bug.cgi?id=1247239
https://www.mozilla.org/en-US/security/advisories/mfsa2013-44/
https://www.mozilla.org/security/advisories/mfsa2016-89/
http://www.securityfocus.com/bid/94337
http://www.securitytracker.com/id/1037298
https://bugzilla.mozilla.org/show_bug.cgi?id=1247239
https://www.mozilla.org/en-US/security/advisories/mfsa2013-44/
https://www.mozilla.org/security/advisories/mfsa2016-89/

Get alerted when CVE-2016-5295 or the next vulnerability affects your stack